wix-vibe-headless
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions for the skill involve downloading additional vendor-owned skills (e.g., wix-manage, wix-base44-connector) using the
npx skills addcommand. These resources are part of the same vendor ecosystem and are necessary for the skill's full functionality. - [COMMAND_EXECUTION]: The deployment process uses Node.js
execSyncto run local installation scripts (deploy.cjs,pin-agents-md.cjs) and CLI tools for project setup. This is used exclusively for administrative tasks such as copying boilerplate code and configuring environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting data from external Wix APIs, such as product descriptions, blog post content, and form schemas. This processing of external, potentially user-controlled data creates a surface area for indirect prompt injection, though the skill provides instructions to render this content safely as rich-text or formatted HTML.
Audit Metadata